Cyber Threat Actor: Rosyjskich hakerów

Rosyjskich hakerów is a threat actor publicly identified by Polish authorities as operating from Russia. This group gained attention following a disruptive cyber campaign against Polish political entities in mid-2025. Their activities demonstrate a focus on undermining digital infrastructure during sensitive electoral periods, though no explicit ideological claims or additional aliases beyond their Russian-language designation have been documented in open sources.

The group primarily targets political organizations within Poland, as evidenced by their coordinated distributed denial-of-service (DDoS) attacks against Platforma Obywatelska's main website and campaign donation portal. This incident caused extended service outages, compelling administrators to proactively disable servers to contain damage. While the attack temporarily crippled critical online resources during an active presidential campaign, investigators confirmed no data exfiltration or direct financial theft occurred. Polish cybercrime units noted secondary targeting of unspecified opposition party assets, suggesting broader interest in disrupting political operations rather than narrowly focused objectives. Operational patterns indicate strategic emphasis on creating visible disruption over covert intelligence gathering or monetary gain, leveraging publicly accessible platforms like Telegram for coordination.

Public attribution by the Polish government links Rosyjskich hakerów to Russian territory, though no specific organizational affiliations, state sponsorship claims, or criminal consortium ties were disclosed in official statements. The May 2025 DDoS campaign represents their only publicly documented operation to date, characterized by its timing during electoral preparations and reliance on high-volume traffic floods to overwhelm targets. Investigators forwarded technical evidence to prosecutors under Poland’s cybercrime statutes, highlighting the incident’s severity despite the absence of permanent data loss. Restoration efforts prioritized maintaining electoral integrity while mitigating collateral impacts on campaign activities. This operation underscores the actor’s capacity to force temporary operational shutdowns through conventional attack methods rather than advanced persistent techniques.